What's going on here? It turns out that the in operator doesn't distinguish between properties created specifically on an object and properties that the object inherited from the prototype chain. In this case in is seeing the constructor property of Object.prototype which all objects inherit from.

It will also return true for user-defined prototype properties. For instance:

Because of this, using in to detect whether an object possesses a given property can be a bit deceptive. Usually we only want to check for properties that belong to the object itself, not its prototype chain. Fortunately, JavaScript has a solution for that. It is called hasOwnProperty.

It is a method on Object.prototype, which means it is available to all JavaScript objects.

Because voldemort defines its own hasOwnProperty, the call never makes it to Object.prototype.hasOwnProperty. It's unlikely that you'll run into an object as maliciously constructed as voldemort, but it's good to be aware of the possibility. Here is the workaround: